@oomkapwn/enquire-mcp 3.10.0-rc.76 → 3.10.0-rc.77

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to this project will be documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.10.0-rc.77] — 2026-06-22
+
+> **TL;DR:** **Full state-driven audit close — LOW: STABILITY.md `obsidian_full_text_search` enabling-flag drift + structural guard.** The packaged semver-contract doc said the FTS tool is opt-in via `--persistent-index` alone, but the code requires `--persistent-index` AND `--diagnostic-search-tools`. Corrected + added a docs-consistency invariant that derives each opt-in/gated tool's flag-set from `TOOL_MANIFEST.gating` and pins STABILITY.md's breakdown headings to it. Docs+test only. **1309 → 1311 source tests. Closes the full state-driven audit (rc.76 MED + rc.77 LOW).**
+
+**Pre-release (v3.10 line) — full state-driven audit close (1 LOW; docs+test, zero runtime change).**
+
+### Fixed
+
+- **LOW — STABILITY.md misstated the enabling flags for `obsidian_full_text_search`** (`STABILITY.md` lines 13 + 19). The packaged stability-contract doc attributed the tool to `--persistent-index` ALONE, but `server.ts:691` registers it under `if (deps.ftsIndex && opts.diagnosticSearchTools)` — i.e. it requires BOTH `--persistent-index` (for `deps.ftsIndex`) AND `--diagnostic-search-tools`. Every other surface is correct (`tool-manifest.ts` gating = `"--persistent-index + --diagnostic-search-tools"`, the tool description, and `docs/api.md` in four places); STABILITY.md was the lone outlier, drifted since v3.5.1. A user who followed STABILITY.md and started `serve --persistent-index` WITHOUT `--diagnostic-search-tools` would not get the tool registered. Same α-class as the rc.22 STABILITY reranker-default drift; LOW because it's a packaged-doc accuracy gap (no security/data impact) and the umbrella `obsidian_search` already exposes BM25/FTS5 with `--persistent-index` alone. **Fix: corrected both lines + closed the untested gap with a structural guard** — the docs-consistency STABILITY invariants pinned tool/prompt COUNTS but nothing pinned the per-flag GATING breakdown prose.
+
+### Tests (1311)
+
+- +2 (`tests/docs-consistency.test.ts`): a new invariant `stabilityGatingMismatches` (pure fn) that DERIVES each non-`"always"` tool's flag-set from `TOOL_MANIFEST.gating` and asserts STABILITY.md's "opt-in via / gated by `<flags>`" breakdown headings name exactly that set — for every opt-in/gated tool, not just FTS. Plus a NEGATIVE control feeding the exact rc.77-drift string (`--persistent-index` alone) and asserting it's caught, with a POSITIVE control on the corrected string. **1309 → 1311.**
+
+> **Lesson:** count-pinning a docs surface (tools/prompts) does not pin its PROSE breakdown (per-flag gating) — a separate claim dimension drifts independently (here since v3.5.1, surviving ~30 audit rounds). Derive the breakdown from the machine-readable source (`TOOL_MANIFEST.gating`) and pin it. **This CLOSES the full state-driven audit (rc.76 MED truncate-before-sort + rc.77 LOW gating drift) — and the entire rc.63→rc.77 cascade (round-3 12-lens audit + 2 post-merge re-sweeps + this full state-driven audit): 1 HIGH + 7 MED + 6 LOW across 15 RCs, every confirmed finding shipped or reasoned-accepted.**
+
+---
+
 ## [3.10.0-rc.76] — 2026-06-21
 
 > **TL;DR:** **Full state-driven audit — MEDIUM: `listPdfs`/`listCanvases`/`listBases` truncated to `limit` in walk order BEFORE sorting by mtime.** A fresh whole-project 6-lens audit (0 CRIT / 0 HIGH / 1 MED / 1 LOW) caught a latent bug the change-driven sweeps missed: all three always-on list tools broke their build loop at `out.length >= limit` over the raw readdir-order entries, then sorted only that already-cut subset — so on a vault with > `limit` (default 100) files of that type the result was an arbitrary, not-newest set, violating the documented "newest first" contract (reproduced: 4 PDFs, limit=2 → the 2 oldest). Fixed by sorting by mtime DESC before truncating at all 3 sites. **1306 → 1309 source tests.**

package/README.md

@@ -15,7 +15,7 @@
 [![CI](https://github.com/oomkapwn/enquire-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/oomkapwn/enquire-mcp/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@oomkapwn/enquire-mcp.svg?label=npm&color=cb3837)](https://www.npmjs.com/package/@oomkapwn/enquire-mcp)
 [![downloads](https://img.shields.io/npm/dm/@oomkapwn/enquire-mcp.svg?color=cb3837)](https://www.npmjs.com/package/@oomkapwn/enquire-mcp)
-[![tests](https://img.shields.io/badge/tests-1309%20passing-brightgreen.svg)](#trust)
+[![tests](https://img.shields.io/badge/tests-1311%20passing-brightgreen.svg)](#trust)
 [![stable](https://img.shields.io/badge/v3.9.x-stable-brightgreen.svg)](./STABILITY.md)
 [![build provenance](https://img.shields.io/badge/build_provenance-SLSA_L2-blue.svg)](https://slsa.dev/spec/v1.0/levels#build-l2)
 [![MCP](https://img.shields.io/badge/MCP-1.29-8A2BE2.svg)](https://modelcontextprotocol.io/)
@@ -51,7 +51,7 @@ Your Obsidian vault becomes **persistent, queryable long-term memory** for any M
 > 3. **Zero cloud calls during serve.** Models cached locally (one-time download from HuggingFace). Your vault content never leaves your machine. Air-gap-safe by default.
 > 4. **Freshness-aware recall.** Every hit reports how old the note is; opt-in recency re-ranking lets an agent prefer fresh knowledge and flag stale facts for re-verification — the forgetting-aware frontier, built on the `mtime` your files already have.
 
-**45 tools · 19 MCP prompts · 1309 unit tests · 50+ languages · v3.9.x stable · semver-bound · MIT · npm build provenance (SLSA L2).**
+**45 tools · 19 MCP prompts · 1311 unit tests · 50+ languages · v3.9.x stable · semver-bound · MIT · npm build provenance (SLSA L2).**
 
 ---
 
@@ -79,7 +79,7 @@ Your Obsidian vault becomes **persistent, queryable long-term memory** for any M
 | **GraphRAG-light** (wikilink community detection via Louvain modularity) | ✅ **only here** | ❌ | ❌ |
 | **Standalone `.base` query execution** (works without Obsidian running) | ✅ **only here** | ❌ | ❌ delegates to Obsidian |
 | **HyDE retrieval** (Gao et al 2023) + sub-question decomposition | ✅ **only here** | ❌ | ❌ |
-| **1309 unit tests · 9 required + 5 advisory CI gates per PR** | ✅ | n/a | rare |
+| **1311 unit tests · 9 required + 5 advisory CI gates per PR** | ✅ | n/a | rare |
 | **Signed build provenance** (npm + Sigstore, SLSA Build L2) | ✅ | n/a | ❌ |
 | **Semver-bound public surface** ([STABILITY.md](./STABILITY.md)) | ✅ | n/a | ❌ |
 | Standalone (no Obsidian plugin needed) | ✅ | ❌ requires Obsidian | varies |
@@ -317,7 +317,7 @@ Channel: `npm install @oomkapwn/enquire-mcp` → latest stable (`@latest` = v3.9
 ```bash
 git clone https://github.com/oomkapwn/enquire-mcp.git
 cd enquire-mcp && npm install
-npm test       # full suite (1309 tests, ~12s)
+npm test       # full suite (1311 tests, ~12s)
 npm run lint   # zero warnings
 npm run build  # tsc → dist/
 ```

package/README.zh.md

@@ -48,7 +48,7 @@ claude mcp add obsidian -- npx -y @oomkapwn/enquire-mcp serve --vault ~/Document
 > 3. **serve 期间零云端调用。** 模型本地缓存（一次性从 HuggingFace 下载）。你的仓库内容永不离开本机。默认即可离线/隔离运行。
 > 4. **时效感知召回。** 每条结果都报告笔记有多旧；可选的时效重排让智能体优先采用新知识，并把陈旧事实标记出来等待复核——这是"遗忘感知"前沿，建立在你的文件本就拥有的 `mtime` 之上。
 
-**45 个工具 · 19 个 MCP 提示词 · 1309+ 单元测试 · 50+ 语言 · v3.9.x 稳定版 · 语义化版本约束 · MIT · npm 构建溯源（SLSA L2）。**
+**45 个工具 · 19 个 MCP 提示词 · 1311+ 单元测试 · 50+ 语言 · v3.9.x 稳定版 · 语义化版本约束 · MIT · npm 构建溯源（SLSA L2）。**
 
 ---
 

package/STABILITY.md

@@ -10,13 +10,13 @@ After **v3.0.0** every CLI flag, MCP tool name, MCP resource URI, MCP prompt nam
 
 ### MCP tool names (45 tools)
 
-45 tools total = **34 always-on read** + **1 opt-in via `--persistent-index`** + **3 opt-in via `--diagnostic-search-tools`** + **7 gated by `--enable-write`**. Names + argument shapes are stable in v3.x.
+45 tools total = **34 always-on read** + **1 opt-in via `--persistent-index` + `--diagnostic-search-tools`** + **3 opt-in via `--diagnostic-search-tools`** + **7 gated by `--enable-write`**. Names + argument shapes are stable in v3.x.
 
 **Read — always-on (34):**
 
 `obsidian_search`, `obsidian_hyde_search`, `obsidian_read_note`, `obsidian_list_notes`, `obsidian_list_tags`, `obsidian_list_canvases`, `obsidian_list_pdfs`, `obsidian_list_bases`, `obsidian_resolve_wikilink`, `obsidian_get_backlinks`, `obsidian_get_outbound_links`, `obsidian_get_note_neighbors`, `obsidian_get_communities`, `obsidian_get_recent_edits`, `obsidian_stale_notes`, `obsidian_get_unresolved_wikilinks`, `obsidian_open_questions`, `obsidian_dataview_query`, `obsidian_frontmatter_get`, `obsidian_frontmatter_search`, `obsidian_find_path`, `obsidian_find_similar`, `obsidian_read_canvas`, `obsidian_read_pdf`, `obsidian_read_base`, `obsidian_query_base`, `obsidian_ocr_pdf`, `obsidian_context_pack`, `obsidian_chat_thread_read`, `obsidian_stats`, `obsidian_lint_wiki`, `obsidian_open_in_ui`, `obsidian_paper_audit`, `obsidian_validate_note_proposal`.
 
-**Read — opt-in via `--persistent-index` (1):** `obsidian_full_text_search`.
+**Read — opt-in via `--persistent-index` + `--diagnostic-search-tools` (1):** `obsidian_full_text_search`.
 
 **Read — opt-in via `--diagnostic-search-tools` (3):** `obsidian_search_text`, `obsidian_semantic_search`, `obsidian_embeddings_search`. Registered alongside `obsidian_search` for diagnostic / A/B benchmarking.
 

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
  * `vault-info` resource payload).
  */
-export declare const VERSION = "3.10.0-rc.76";
+export declare const VERSION = "3.10.0-rc.77";
 export { main } from "./cli.js";
 export { buildEmbedText, buildMcpServer, formatReadyBanner, prepareServerDeps, type ServeOptions, type ServerDeps, startServer } from "./server.js";
 export { parsePositiveInt, parseQuantizationMode } from "./tool-registry.js";

package/dist/index.js

@@ -40,7 +40,7 @@ import { main } from "./cli.js";
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
  * `vault-info` resource payload).
  */
-export const VERSION = "3.10.0-rc.76";
+export const VERSION = "3.10.0-rc.77";
 // Re-exports — preserve the v3.5.x public surface so http-transport.ts and
 // tests don't need to know about the new module layout. The set below
 // exactly matches the v3.5.x `export` declarations: `main`,

package/docs/COMPARISON.md

@@ -44,7 +44,7 @@ The four axes the external audit (#3, 2026-05) called out as decisive — **REST
 | Zero outbound network calls in serve mode     | **Yes** (default)   | Local-only (REST)| Local-only (REST)| Yes              | Yes              |
 | Signed build provenance on releases (SLSA L2) | **Yes**             | No               | No               | No               | No               |
 | Forgetting-aware freshness (`age_days` / recency re-rank) | Yes (v3.10)     | No               | No               | No               | No               |
-| Test count (public)                           | **1309**             | (varies)         | (varies)         | (varies)         | (varies)         |
+| Test count (public)                           | **1311**             | (varies)         | (varies)         | (varies)         | (varies)         |
 | Tool count                                    | 45                  | ~25              | ~8               | ~10              | 3–5              |
 | MCP prompt count                              | 19                  | 0                | 0                | 0                | 0                |
 | License                                       | MIT                 | Apache-2.0       | MIT              | MIT              | (varies)         |

package/package.json

@@ -1,9 +1,9 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@oomkapwn/enquire-mcp",
-  "version": "3.10.0-rc.76",
+  "version": "3.10.0-rc.77",
   "mcpName": "io.github.oomkapwn/enquire-mcp",
-  "description": "MCP server giving AI agents (Claude Code, Claude Desktop, Cursor, ChatGPT, Codex, OpenClaw) persistent long-term memory backed by your local Obsidian markdown vault. Hybrid retrieval (BM25 + ML embeddings + BGE reranker, RRF-fused), HNSW + int8 quantization, agentic RAG (HyDE + sub-question decomposition), GraphRAG-light (Louvain), standalone Obsidian Bases, PDFs + Tesseract OCR. Vendor-neutral memory layer for any MCP-compatible agent. 45 tools, 19 MCP prompts, 1309 tests, signed npm build provenance (SLSA L2), semver-bound, MIT, zero cloud calls during serve.",
+  "description": "MCP server giving AI agents (Claude Code, Claude Desktop, Cursor, ChatGPT, Codex, OpenClaw) persistent long-term memory backed by your local Obsidian markdown vault. Hybrid retrieval (BM25 + ML embeddings + BGE reranker, RRF-fused), HNSW + int8 quantization, agentic RAG (HyDE + sub-question decomposition), GraphRAG-light (Louvain), standalone Obsidian Bases, PDFs + Tesseract OCR. Vendor-neutral memory layer for any MCP-compatible agent. 45 tools, 19 MCP prompts, 1311 tests, signed npm build provenance (SLSA L2), semver-bound, MIT, zero cloud calls during serve.",
   "type": "module",
   "bin": {
     "enquire-mcp": "dist/index.js"